{"id":26,"date":"2020-04-27T12:19:53","date_gmt":"2020-04-27T12:19:53","guid":{"rendered":"https:\/\/shreyapohekar.com\/blogs\/?p=26"},"modified":"2020-05-09T11:02:15","modified_gmt":"2020-05-09T11:02:15","slug":"hackthebox-traverxec-walkthrough","status":"publish","type":"post","link":"https:\/\/shreyapohekar.com\/blogs\/hackthebox-traverxec-walkthrough\/","title":{"rendered":"HackTheBox : Traverxec Walkthrough"},"content":{"rendered":"\n

Hello all! This is Shreya Pohekar. Today we\u2019ll be doing traverxec from hack the box. This box recently retired and is available for free in the retired machines section. So if you got stuck somewhere while the machine was active, follow the walkthrough and submit the flags.<\/p>\n\n\n\n

The machine is an easy Linux box that requires you to do a bit of enumeration to find out the creds of admin. The initial foothold on the box is based on exploiting the Nostromo 1.9.6. But still getting to user was a bit tricky. Just need to study the right file. Privilege escalation to root was pretty simple as it exploited journalctl running with sudo.<\/p>\n\n\n\n

With all that said, lets get started!!<\/p>\n\n\n\n

Perform a nmap scan to find the open ports<\/p>\n\n\n\n

# nmap -sC -sV -oA traverex.nmap 10.10.10.165<\/pre>\n\n\n\n
\"\"\/<\/figure>\n\n\n\n
The nmap scan defines that notromo 1.9.6 is running on http. So we can search if the version is exploitable.<\/p>\n\n\n\n
# searchsploit nostromo 1.9.6<\/pre>\n\n\n\n
\"\"\/<\/figure>\n\n\n\n
Fire up http:\/\/10.10.10.165<\/a> in the browser and a website loads with portfolio theme<\/p>\n\n\n\n
\"\"\/<\/figure>\n\n\n\n
After reading the exploit, I got to know that the script takes 3 arguments<\/p>\n\n\n\n
\n
  • IP<\/li><\/ul>\n\n\n\n
    • Port <\/li><\/ul>\n\n\n\n
      • Reverse shell<\/li><\/ul>\n<\/div><\/div>\n\n\n\n
        So I built up the query and set up a nc listener. Upon execution, I got the www-data shell<\/p>\n\n\n\n
        \"\"\/<\/figure>\n\n\n\n
        But access to \/home\/david<\/b> was denied.<\/p>\n\n\n\n
        Upon enumeration, I found the the nostromo config file<\/p>\n\n\n\n
        \"\"\/<\/figure>\n\n\n\n
        \"\"\/<\/figure>\n\n\n\n
        I took the hash to hash identifier and the hash was identified as md5<\/p>\n\n\n\n
        \"\"\/<\/figure>\n\n\n\n
        \"\"\/<\/figure>\n\n\n\n
        The password cracked to be Nowonly4me<\/b>, but there was unsuccessful ssh login or su david<\/p>\n\n\n\n
        So I reverted back to the conf file I was looking at and found something interesting. There is a directory public_www<\/b>, accessible by the current user.<\/p>\n\n\n\n
        \"\"\/<\/figure>\n\n\n\n
        After traversing through the directories, I found the ssh backup file that had read permission.<\/p>\n\n\n\n
        \"\"\/<\/figure>\n\n\n\n
        So i transferred the file to my local machine using nc<\/p>\n\n\n\n
        \"\"\/<\/figure>\n\n\n\n
        After extracting the .txz, we got the .ssh files of the user david<\/p>\n\n\n\n
        \"\"\/<\/figure>\n\n\n\n
        I tried to ssh to david, but the id_rsa was encrypted with  a passphrase. So now the id_rsa passphrase will be cracked using ssh2john<\/p>\n\n\n\n
        \"\"\/<\/figure>\n\n\n\n
        Now with the obtained password, login in with david user as follows and grep the user.txt<\/p>\n\n\n\n
        \"\"\/<\/figure>\n\n\n\n
        After getting the user level access, I found a bin directory present. I listed its contents using cat<\/p>\n\n\n\n
        \"\"\/<\/figure>\n\n\n\n
        Journalctl service was running with sudo privileges so I can edit the server-stats.sh<\/b> to get to root.<\/p>\n\n\n\n
        \"\"\/<\/figure>\n\n\n\n
        In either way, just copy the last command uptil the pipe and type !\/bin\/bash . This can be used to access the files system with elevated privileges. In a nutshell, we are now root.<\/p>\n\n\n\n
        \"\"\/<\/figure>\n\n\n\n
        Thats all for the blog post. Thanks for reading.<\/p>\n\n\n\n
        Unitl then, Happy Hacking!!<\/p>\n","protected":false},"excerpt":{"rendered":"
        Hello all! This is Shreya Pohekar. Today we\u2019ll be doing traverxec from hack the box. This box recently retired and is available for free in the retired machines section. So if you got stuck somewhere while the machine was active, follow the walkthrough and submit the flags. The machine is an easy Linux box that […]<\/p>\n","protected":false},"author":1,"featured_media":29,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ocean_post_layout":"","ocean_both_sidebars_style":"","ocean_both_sidebars_content_width":0,"ocean_both_sidebars_sidebars_width":0,"ocean_sidebar":"","ocean_second_sidebar":"","ocean_disable_margins":"enable","ocean_add_body_class":"","ocean_shortcode_before_top_bar":"","ocean_shortcode_after_top_bar":"","ocean_shortcode_before_header":"","ocean_shortcode_after_header":"","ocean_has_shortcode":"","ocean_shortcode_after_title":"","ocean_shortcode_before_footer_widgets":"","ocean_shortcode_after_footer_widgets":"","ocean_shortcode_before_footer_bottom":"","ocean_shortcode_after_footer_bottom":"","ocean_display_top_bar":"default","ocean_display_header":"default","ocean_header_style":"","ocean_center_header_left_menu":"","ocean_custom_header_template":"","ocean_custom_logo":0,"ocean_custom_retina_logo":0,"ocean_custom_logo_max_width":0,"ocean_custom_logo_tablet_max_width":0,"ocean_custom_logo_mobile_max_width":0,"ocean_custom_logo_max_height":0,"ocean_custom_logo_tablet_max_height":0,"ocean_custom_logo_mobile_max_height":0,"ocean_header_custom_menu":"","ocean_menu_typo_font_family":"","ocean_menu_typo_font_subset":"","ocean_menu_typo_font_size":0,"ocean_menu_typo_font_size_tablet":0,"ocean_menu_typo_font_size_mobile":0,"ocean_menu_typo_font_size_unit":"px","ocean_menu_typo_font_weight":"","ocean_menu_typo_font_weight_tablet":"","ocean_menu_typo_font_weight_mobile":"","ocean_menu_typo_transform":"","ocean_menu_typo_transform_tablet":"","ocean_menu_typo_transform_mobile":"","ocean_menu_typo_line_height":0,"ocean_menu_typo_line_height_tablet":0,"ocean_menu_typo_line_height_mobile":0,"ocean_menu_typo_line_height_unit":"","ocean_menu_typo_spacing":0,"ocean_menu_typo_spacing_tablet":0,"ocean_menu_typo_spacing_mobile":0,"ocean_menu_typo_spacing_unit":"","ocean_menu_link_color":"","ocean_menu_link_color_hover":"","ocean_menu_link_color_active":"","ocean_menu_link_background":"","ocean_menu_link_hover_background":"","ocean_menu_link_active_background":"","ocean_menu_social_links_bg":"","ocean_menu_social_hover_links_bg":"","ocean_menu_social_links_color":"","ocean_menu_social_hover_links_color":"","ocean_disable_title":"default","ocean_disable_heading":"default","ocean_post_title":"","ocean_post_subheading":"","ocean_post_title_style":"","ocean_post_title_background_color":"","ocean_post_title_background":0,"ocean_post_title_bg_image_position":"","ocean_post_title_bg_image_attachment":"","ocean_post_title_bg_image_repeat":"","ocean_post_title_bg_image_size":"","ocean_post_title_height":0,"ocean_post_title_bg_overlay":0.5,"ocean_post_title_bg_overlay_color":"","ocean_disable_breadcrumbs":"default","ocean_breadcrumbs_color":"","ocean_breadcrumbs_separator_color":"","ocean_breadcrumbs_links_color":"","ocean_breadcrumbs_links_hover_color":"","ocean_display_footer_widgets":"default","ocean_display_footer_bottom":"default","ocean_custom_footer_template":"","ocean_post_oembed":"","ocean_post_self_hosted_media":"","ocean_post_video_embed":"","ocean_link_format":"","ocean_link_format_target":"self","ocean_quote_format":"","ocean_quote_format_link":"post","ocean_gallery_link_images":"on","ocean_gallery_id":[],"footnotes":""},"categories":[19,2],"tags":[26,33,35,34,36],"class_list":["post-26","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hackthebox","category-information-security","tag-hackthebox","tag-journalctl-exploit","tag-nostromo","tag-nostromo-1-9-6","tag-traverxec-walkthrough","entry","has-media"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/posts\/26"}],"collection":[{"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/comments?post=26"}],"version-history":[{"count":4,"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/posts\/26\/revisions"}],"predecessor-version":[{"id":112,"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/posts\/26\/revisions\/112"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/media\/29"}],"wp:attachment":[{"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/media?parent=26"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/categories?post=26"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/shreyapohekar.com\/blogs\/wp-json\/wp\/v2\/tags?post=26"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}